Twelve Terabytes a Day

Cut at the source and at the tier, never at the retention floor of the regulated classes.

Where the volume is: network flow and verbose application debug output are almost certainly the bulk, and they carry the least regulatory obligation. The cut comes from three places - field-level verbosity reduction (dropping payloads and high-cardinality debug fields), moving those classes from 30-day hot to 14-day hot plus 90-day cold archive, and eliminating duplicate ingestion where the same event arrives via two pipelines.

What must not be touched:

1. Authentication and administrative-action logs at 12 months. This is the floor, not a target, and it is the one class the regulator named explicitly.
2. Anything inside the litigation hold. The scope is all system activity for the affected accounts, extending back eighteen months - older than anything in hot storage. Deleting or making that unsearchable is spoliation, and it is a far larger exposure than the storage bill.

The judgement call: the litigation hold overrides the cost exercise wherever they intersect. Get legal to narrow the scope in writing before a single log inside it is deleted, and freeze deletions in that account range until they do.

Oppose sampling flow logs, and use the 47 days as the argument.

A 47-day undetected intrusion means your realistic detection window is measured in weeks, not hours. Any retention or fidelity cut below that horizon creates a blind spot precisely where the attacker operates - low and slow. Sampling does not merely reduce volume; it removes the ability to reconstruct lateral movement, which is the exact question a long-dwell investigation must answer.

The sampling error is also biased, not random. Low-and-slow beaconing is low-volume by design, so a 1-in-10 sample discards it at a far higher effective rate than it discards bulk traffic. The retained data skews toward chatty hosts and away from quiet ones - the sample systematically prefers the innocent.

The alternative that gets the same saving: keep full flow records but strip payload, reduce to connection-level metadata, and aggregate into one-minute buckets. This preserves the ability to answer who talked to whom, when, and for how long - which is what investigations actually ask - while removing the field-level bulk. Keep full fidelity for 30 days and bucketed metadata for 90. Cut the width of the record, not the population of records.

Measure retained capability, not cost avoided.

Run a retrieval test against the new tiering before you commit to it, using three real question sets drawn from past investigations: one phishing-led intrusion, one lateral-movement case, and one scoped to the litigation-hold accounts. Time how long it takes an analyst to answer the core questions - initial access vector, affected hosts, blast radius - from the cheaper data. If any of the three cannot be answered, the saving has a named capability gap attached to it.

Report alongside the cost number:

• Time-to-detect on seeded activity, per log class, at the new retention settings.
• A documented gap register: which questions are no longer answerable, for which sources, and how far back.
• The gap register signed by the risk owner, not by the security team alone.

What I would refuse to report: percentage cost saved on its own. It is the one number that always looks good, and it is completely uninformative about whether you can still investigate an incident. The defensible framing is cost saved per unit of retained investigative capability, with the residual gaps explicitly listed and accepted by someone with the authority to accept them.